CVE-2026-82819

UNKNOWN 0.0

Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

CWE	CWE-40
Vendor	cerberus
Product	cerberus ftp server
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for cerberus cerberus ftp server

Be the first to know when new unknown vulnerabilities affecting cerberus cerberus ftp server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Cerberus / Cerberus FTP Server

0 < 2026.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cerberusftp.com: https://www.cerberusftp.com/releasenotes/ labs.reversec.com: https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server